sign verify

[g-k]

WIP branch

TODO:

• [x] correct
  • [x] CBORDecode cases pass (alg = -7 instead of -6) (edit: -7 for alg=ES256 is right, I just need to ignore the RHS in the cbor.me playground https://github.com/cbor/cbor.github.io/issues/41)
  • [x] wg /sign-tests pass
  • [x] wg /ecdsa-examples pass
  • [x] cose-rust test cases pass
  • [x] delete or get the commented out cbor encode Marshal test cases passing
  • [x] sign an addon and have cose-rust verify it
  • [x] add cose-rust verify test example w/ cli args (usage: NSS_LIB_DIR=/usr/local/opt/nss/lib/ cargo run --example sign_verify -- $(cat ../../xpi_payload_hex) $(cat ../../xpi_sig_hex)) NB: :ulfr cleared up that we already have shared certs from the test vectors
• [x] feature complete for Addon Signing
  • [x] Sign Message support
  • [x] required algs
  • [x] ES256, 384, 521
  • [x] PS256
  • [x] sign and verify multiple signatures
• [x] code quality / cleanup
  • [x] don't return ok and err from Verify
  • [x] don't return ToBeSigned from Sign
  • [x] API docs https://godoc.org/gopkg.in/g-k/go-cose.v0
  • [x] golint passes (going to leave the rust cose consts as is so they're easy to grep)
  • [x] enable CI
  • [x] rm stray debug prints
  • [x] gofmt
  • [x] better code coverage (say 80+%)
  • [x] useful docstrings
  • [x] fix the generated alg and common header tags (they should all be const-like or in a static index/map of some sort) they are tidier (everything using COSEAlgorithms array / not maintaining multiple sets of alg data)
  • [x] extract errors to named vars
  • [x] use go.mozilla.org for imports
  • [x] usage docs
  • [x] fix TODOs will split out separate issues for these